Python Software Foundation CPython

• CVE-2025-13837 Low 2.1 Out-of-memory when loading Plist 0.2%
• CVE-2025-13836 Medium 6.3 Excessive read buffering DoS in http.client 1.7%
• CVE-2025-6075 Low 1.8 Quadratic complexity in os.path.expandvars() with user-controlled template 0.1%
• CVE-2025-8291 Medium 4.3 ZIP64 End of Central Directory (EOCD) Locator record offset not checked 0.5%
• CVE-2025-8194 High 7.5 Tarfile infinite loop during parsing with negative member offset 0.8%
• CVE-2025-6069 Medium 4.3 HTMLParser quadratic complexity when processing malformed inputs 0.6%
• CVE-2024-12718 Medium 5.3 Bypass extraction filter to modify file metadata outside extraction directory 0.8%
• CVE-2025-4435 High 7.5 Tarfile extracts filtered members when errorlevel=0 0.6%
• CVE-2025-4138 High 7.5 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory 1.5%
• CVE-2025-4330 High 7.5 Extraction filter bypass for linking outside extraction directory 1.0%
• CVE-2025-4517 Critical 9.4 Arbitrary writes via tarfile realpath overflow 1.5%
• CVE-2025-4516 Medium 5.9 Use-after-free in "unicode_escape" decoder with error handler 0.2%
• CVE-2025-1795 Low 2.3 Mishandling of comma during folding and unicode-encoding of email headers 0.6%
• CVE-2024-3220 Low 2.3 Default mimetype known files writeable on Windows 0.7%
• CVE-2025-0938 Medium 6.3 URL parser allowed square brackets in domain names 1.6%
• CVE-2024-12254 High 7.5 Unbounded memory buffering in SelectorSocketTransport.writelines() 1.9%
• CVE-2024-11168 Low 3.7 Improper validation of IPv6 and IPvFuture addresses 0.7%
• CVE-2024-9287 Medium 5.3 Virtual environment (venv) activation scripts don't quote paths 0.6%
• CVE-2024-6232 High 7.5 Regular-expression DoS when parsing TarFile headers 2.2%
• CVE-2024-8088 High 8.7 Infinite loop when iterating over zip archive entry names from zipfile.Path 1.3%
• CVE-2024-7592 High 7.5 Quadratic complexity parsing cookies with backslashes 2.3%
• CVE-2024-6923 Medium 5.5 Email header injection due to unquoted newlines 1.1%
• CVE-2024-3219 Medium 5.1 Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection 0.2%
• CVE-2024-5642 Medium 6.5 Buffer overread when using an empty list with SSLContext.set_npn_protocols() 0.7%
• CVE-2024-0397 High 7.4 Memory race condition in ssl.SSLContext certificate store methods 0.8%
• CVE-2024-4032 High 7.5 Incorrect IPv4 and IPv6 private ranges 1.1%
• CVE-2024-4030 High 7.1 tempfile.mkdtemp() may be readable and writeable by all users on Windows 0.3%
• CVE-2023-6597 High 7.8 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference 0.3%
• CVE-2024-0450 Medium 6.2 Quoted zip-bomb protection for zipfile 0.3%
• CVE-2023-6507 Medium 6.1 Groups not dropped before running subprocess when using empty 'extra_groups' parameter 1.3%